<!DOCTYPE html>
<html>
  <head>
  <meta http-equiv="content-type" content="text/html; charset=utf-8">
  <meta content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=0" name="viewport">
  <meta name="description" content="JinYan&#39;s blog">
  <meta name="keyword" content="hexo-theme, vuejs">
  
    <link rel="shortcut icon" href="/blog/css/images/logo.jpg">
  
  <title>
    
      Linux-Iptables-常用规则 | SanYuanEmpire
    
  </title>
  <link href="//cdn.bootcss.com/font-awesome/4.7.0/css/font-awesome.min.css" rel="stylesheet">
  <link href="//cdn.bootcss.com/nprogress/0.2.0/nprogress.min.css" rel="stylesheet">
  <link href="//cdn.bootcss.com/highlight.js/9.12.0/styles/tomorrow.min.css" rel="stylesheet">
  <link rel="stylesheet" href="/blog/css/style.css">
<link rel="stylesheet" href="/blog/css/plugins/gitment.css">
  <script src="//cdn.bootcss.com/jquery/3.2.1/jquery.min.js"></script>
  <script src="//cdn.bootcss.com/geopattern/1.2.3/js/geopattern.min.js"></script>
  <script src="//cdn.bootcss.com/nprogress/0.2.0/nprogress.min.js"></script>
  <script src="/blog/js/qrious.js"></script>
<script src="/blog/js/gitment.js"></script>
  
  
    <!-- MathJax support START -->
    <script type="text/x-mathjax-config">
      MathJax.Hub.Config({
        tex2jax: {
          inlineMath: [ ['$','$'], ["\\(","\\)"]  ],
          processEscapes: true,
          skipTags: ['script', 'noscript', 'style', 'textarea', 'pre', 'code']
        }
      });
    </script>

    <script type="text/x-mathjax-config">
      MathJax.Hub.Queue(function() {
        var all = MathJax.Hub.getAllJax(), i;
        for (i=0; i < all.length; i += 1) {
          all[i].SourceElement().parentNode.className += ' has-jax';
        }
      });
    </script>
    <script type="text/javascript" src="//cdn.bootcss.com/mathjax/2.7.1/latest.js?config=TeX-AMS-MML_HTMLorMML"></script>
    <!-- MathJax support END -->
  


</head>
<div class="wechat-share">
  <img src="/css/images/logo.jpg" />
</div>

  <body>
    <header class="header fixed-header">
  <div class="header-container">
    <a class="home-link" href="/blog/">
      <div class="logo"></div>
      <span>SanYuanEmpire</span>
    </a>
    <ul class="right-list">
      
        <li class="list-item">
          
            <a href="/blog/" class="item-link">Home</a>
          
        </li>
      
        <li class="list-item">
          
            <a href="/blog/archives/" class="item-link">Archives</a>
          
        </li>
      
    </ul>
    <div class="menu">
      <span class="icon-bar"></span>
      <span class="icon-bar"></span>
      <span class="icon-bar"></span>
    </div>
    <div class="menu-mask">
      <ul class="menu-list">
        
          <li class="menu-item">
            
              <a href="/blog/" class="menu-link">Home</a>
            
          </li>
        
          <li class="menu-item">
            
              <a href="/blog/archives/" class="menu-link">Archives</a>
            
          </li>
        
      </ul>
    </div>
  </div>
</header>

    <div id="article-banner">
  <h2>Linux-Iptables-常用规则</h2>
  <p class="post-date">2018-09-03</p>
  <div class="arrow-down">
    <a href="javascript:;"></a>
  </div>
</div>
<main class="app-body flex-box">
  <!-- Article START -->
  <article class="post-article">
    <section class="markdown-content"><h1 id="启动、停止和重启iptables"><a href="#启动、停止和重启iptables" class="headerlink" title="启动、停止和重启iptables"></a>启动、停止和重启iptables</h1><ul>
<li>虽然 iptables并不是一项服务，但在 Linux 中还是可以像服务一样对其状态进行管理。<h2 id="基于SystemD的系统"><a href="#基于SystemD的系统" class="headerlink" title="基于SystemD的系统"></a>基于SystemD的系统</h2>systemctl start iptables<br>systemctl stop iptables<br>systemctl restart iptables<h2 id="基于SysVinit的系统"><a href="#基于SysVinit的系统" class="headerlink" title="基于SysVinit的系统"></a>基于SysVinit的系统</h2>/etc/init.d/iptables start<br>/etc/init.d/iptables stop<br>/etc/init.d/iptables restart</li>
</ul>
<h1 id="屏蔽某个IP地址"><a href="#屏蔽某个IP地址" class="headerlink" title="屏蔽某个IP地址"></a>屏蔽某个IP地址</h1><p>如果你发布有某个 IP 向服务器导入×××或非正常流量，可以使用如下规则屏蔽其 IP 地址：<br>iptables -A INPUT -s xxx.xxx.xxx.xxx -j DROP<br>注意需要将上述的 XXX 改成要屏蔽的实际 IP 地址，其中的 -A 参数表示在 INPUT 链的最后追加本条规则。（IPTables 中的规则是从上到下匹配的，一旦匹配成功就不再继续往下匹配）<br>如果你只想屏蔽 TCP 流量，可以使用 -p 参数的指定协议，例如：<br>iptables -A INPUT -p tcp -s xxx.xxx.xxx.xxx -j DROP</p>
<h1 id="阻止某个特定的-IP-地址"><a href="#阻止某个特定的-IP-地址" class="headerlink" title="阻止某个特定的 IP 地址"></a>阻止某个特定的 IP 地址</h1><p>BLOCK_THIS_IP=”x.x.x.x”<br>iptables -A INPUT -s “$BLOCK_THIS_IP” -j DRO</p>
<h1 id="解封某个IP地址"><a href="#解封某个IP地址" class="headerlink" title="解封某个IP地址"></a>解封某个IP地址</h1><p>要解封对 IP 地址的屏蔽，可以使用如下命令进行删除：<br>iptables -D INPUT -s xxx.xxx.xxx.xxx -j DROP<br>其中 -D 参数表示从链中删除一条或多条规则。</p>
<h1 id="使用IPtables关闭特定端口"><a href="#使用IPtables关闭特定端口" class="headerlink" title="使用IPtables关闭特定端口"></a>使用IPtables关闭特定端口</h1><p>很多时候，我们需要阻止某个特定端口的网络连接，可以使用 IPtables 关闭特定端口。</p>
<blockquote>
<p>阻止特定的传出连接：<br>iptables -A OUTPUT -p tcp –dport xxx -j DROP<br>阻止特定的传入连接：<br>iptables -A INPUT -p tcp –dport xxx -j ACCEPT</p>
</blockquote>
<h1 id="允许全部入站的（incoming）SSH"><a href="#允许全部入站的（incoming）SSH" class="headerlink" title="允许全部入站的（incoming）SSH"></a>允许全部入站的（incoming）SSH</h1><p>iptables -A INPUT -i eth0 -p tcp –dport 22 -m state –state NEW,ESTABLISHED -j ACCEPT<br>iptables -A OUTPUT -o eth0 -p tcp –sport 22 -m state –state ESTABLISHED -j ACCEPT</p>
<h1 id="只允许某个特定网络进来的-SSH"><a href="#只允许某个特定网络进来的-SSH" class="headerlink" title="只允许某个特定网络进来的 SSH"></a>只允许某个特定网络进来的 SSH</h1><p>iptables -A INPUT -i eth0 -p tcp -s 192.168.200.0/24 –dport 22 -m state –state NEW,ESTABLISHED -j ACCEPT<br>iptables -A OUTPUT -o eth0 -p tcp –sport 22 -m state –state ESTABLISHED -j ACCEPT</p>
<h1 id="允许入站的（incoming）HTTP"><a href="#允许入站的（incoming）HTTP" class="headerlink" title="允许入站的（incoming）HTTP"></a>允许入站的（incoming）HTTP</h1><p>iptables -A INPUT -i eth0 -p tcp –dport 80 -m state –state NEW,ESTABLISHED -j ACCEPT<br>iptables -A OUTPUT -o eth0 -p tcp –sport 80 -m state –state ESTABLISHED -j ACCEPT</p>
<h1 id="多端口（允许进来的-SSH、HTTP-和-HTTPS）"><a href="#多端口（允许进来的-SSH、HTTP-和-HTTPS）" class="headerlink" title="多端口（允许进来的 SSH、HTTP 和 HTTPS）"></a>多端口（允许进来的 SSH、HTTP 和 HTTPS）</h1><p>iptables -A INPUT -i eth0 -p tcp -m multiport –dports 22,80,443 -m state –state NEW,ESTABLISHED -j ACCEPT<br>iptables -A OUTPUT -o eth0 -p tcp -m multiport –sports 22,80,443 -m state –state ESTABLISHED -j ACCEPT</p>
<h1 id="允许出站的（outgoing）SSH"><a href="#允许出站的（outgoing）SSH" class="headerlink" title="允许出站的（outgoing）SSH"></a>允许出站的（outgoing）SSH</h1><p>iptables -A OUTPUT -o eth0 -p tcp –dport 22 -m state –state NEW,ESTABLISHED -j ACCEPT<br>iptables -A INPUT -i eth0 -p tcp –sport 22 -m state –state ESTABLISHED -j ACCEPT</p>
<h1 id="允许出站的（outgoing）SSH，但仅访问某个特定的网络"><a href="#允许出站的（outgoing）SSH，但仅访问某个特定的网络" class="headerlink" title="允许出站的（outgoing）SSH，但仅访问某个特定的网络"></a>允许出站的（outgoing）SSH，但仅访问某个特定的网络</h1><p>iptables -A OUTPUT -o eth0 -p tcp -d 192.168.101.0/24 –dport 22 -m state –state NEW,ESTABLISHED -j ACCEPT<br>iptables -A INPUT -i eth0 -p tcp –sport 22 -m state –state ESTABLISHED -j ACCEPT</p>
<h1 id="允许出站的（outgoing）-HTTPS"><a href="#允许出站的（outgoing）-HTTPS" class="headerlink" title="允许出站的（outgoing） HTTPS"></a>允许出站的（outgoing） HTTPS</h1><p>iptables -A OUTPUT -o eth0 -p tcp –dport 443 -m state –state NEW,ESTABLISHED -j ACCEPT<br>iptables -A INPUT -i eth0 -p tcp –sport 443 -m state –state ESTABLISHED -j ACCEPT</p>
<h1 id="对进来的-HTTPS-流量做负载均衡"><a href="#对进来的-HTTPS-流量做负载均衡" class="headerlink" title="对进来的 HTTPS 流量做负载均衡"></a>对进来的 HTTPS 流量做负载均衡</h1><p>iptables -A PREROUTING -i eth0 -p tcp –dport 443 -m state –state NEW -m nth –counter 0 –every 3 –packet 0 -j DNAT –to-destination 192.168.1.101:443<br>iptables -A PREROUTING -i eth0 -p tcp –dport 443 -m state –state NEW -m nth –counter 0 –every 3 –packet 1 -j DNAT –to-destination 192.168.1.102:443<br>iptables -A PREROUTING -i eth0 -p tcp –dport 443 -m state –state NEW -m nth –counter 0 –every 3 –packet 2 -j DNAT –to-destination 192.168.1.103:443</p>
<h1 id="从内部向外部-Ping"><a href="#从内部向外部-Ping" class="headerlink" title="从内部向外部 Ping"></a>从内部向外部 Ping</h1><p>iptables -A OUTPUT -p icmp –icmp-type echo-request -j ACCEPT<br>iptables -A INPUT -p icmp –icmp-type echo-reply -j ACCEPT</p>
<h1 id="从外部向内部-Ping"><a href="#从外部向内部-Ping" class="headerlink" title="从外部向内部 Ping"></a>从外部向内部 Ping</h1><p>iptables -A INPUT -p icmp –icmp-type echo-request -j ACCEPT<br>iptables -A OUTPUT -p icmp –icmp-type echo-reply -j ACCEPT</p>
<h1 id="使用Multiport控制多端口"><a href="#使用Multiport控制多端口" class="headerlink" title="使用Multiport控制多端口"></a>使用Multiport控制多端口</h1><p>使用 multiport 我们可以一次性在单条规则中写入多个端口，例如：<br>iptables -A INPUT -p tcp -m multiport –dports 22,80,443 -j ACCEPT<br>iptables -A OUTPUT -p tcp -m multiport –sports 22,80,443 -j ACCEPT</p>
<h1 id="在规则中使用-IP-地址范围"><a href="#在规则中使用-IP-地址范围" class="headerlink" title="在规则中使用 IP 地址范围"></a>在规则中使用 IP 地址范围</h1><p>在 IPtables 中 IP 地址范围是可以直接使用 CIDR 进行表示的，例如：<br>iptables -A OUTPUT -p tcp -d 192.168.100.0/24 –dport 22 -j ACCEPT</p>
<h1 id="配置端口转发"><a href="#配置端口转发" class="headerlink" title="配置端口转发"></a>配置端口转发</h1><p>有时我们需要将 Linux 服务器的某个服务流量转发到另一端口，此时可以使用如下命令：<br>iptables -t nat -A PREROUTING -i eth0 -p tcp –dport 25 -j REDIRECT –to-port 2525<br>上述命令会将所有到达 eth0 网卡 25 端口的流量重定向转发到 2525 端口。</p>
<p>#屏蔽HTTP服务Flood×××<br>有时会有用户在某个服务，例如 HTTP 80 上发起大量连接请求，此时我们可以启用如下规则：<br>iptables -A INPUT -p tcp –dport 80 -m limit –limit 100/minute –limit-burst 200 -j ACCEPT<br>上述命令会将连接限制到每分钟 100 个，上限设定为 200。</p>
<h1 id="禁止PING"><a href="#禁止PING" class="headerlink" title="禁止PING"></a>禁止PING</h1><p>对 Linux 禁 PING 可以使用如下规则屏蔽 ICMP 传入连接：<br>iptables -A INPUT -p icmp -i eth0 -j DROP</p>
<h1 id="允许访问回环网卡"><a href="#允许访问回环网卡" class="headerlink" title="允许访问回环网卡"></a>允许访问回环网卡</h1><p>环回访问（127.0.0.1）是比较重要的，建议大家都开放：<br>iptables -A INPUT -i lo -j ACCEPT<br>iptables -A OUTPUT -o lo -j ACCEPT</p>
<h1 id="允许-packets-从内网访问外网"><a href="#允许-packets-从内网访问外网" class="headerlink" title="允许 packets 从内网访问外网"></a>允许 packets 从内网访问外网</h1><p>if eth1 is connected to external network (internet)<br>if eth0 is connected to internal network (192.168.1.x)<br>iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT</p>
<h1 id="允许外出的-DNS"><a href="#允许外出的-DNS" class="headerlink" title="允许外出的 DNS"></a>允许外出的 DNS</h1><p>iptables -A OUTPUT -p udp -o eth0 –dport 53 -j ACCEPT<br>iptables -A INPUT -p udp -i eth0 –sport 53 -j ACCEPT</p>
<h1 id="允许-NIS-连接"><a href="#允许-NIS-连接" class="headerlink" title="允许 NIS 连接"></a>允许 NIS 连接</h1><p>rpcinfo -p | grep ypbind ; This port is 853 and 850<br>iptables -A INPUT -p tcp –dport 111 -j ACCEPT<br>iptables -A INPUT -p udp –dport 111 -j ACCEPT<br>iptables -A INPUT -p tcp –dport 853 -j ACCEPT<br>iptables -A INPUT -p udp –dport 853 -j ACCEPT<br>iptables -A INPUT -p tcp –dport 850 -j ACCEPT<br>iptables -A INPUT -p udp –dport 850 -j ACCEPT</p>
<h1 id="允许某个特定网络-rsync-进入本机"><a href="#允许某个特定网络-rsync-进入本机" class="headerlink" title="允许某个特定网络 rsync 进入本机"></a>允许某个特定网络 rsync 进入本机</h1><p>iptables -A INPUT -i eth0 -p tcp -s 192.168.101.0/24 –dport 873 -m state –state NEW,ESTABLISHED -j ACCEPT<br>iptables -A OUTPUT -o eth0 -p tcp –sport 873 -m state –state ESTABLISHED -j ACCEPT</p>
<h1 id="仅允许来自某个特定网络的-MySQL-的链接"><a href="#仅允许来自某个特定网络的-MySQL-的链接" class="headerlink" title="仅允许来自某个特定网络的 MySQL 的链接"></a>仅允许来自某个特定网络的 MySQL 的链接</h1><p>iptables -A INPUT -i eth0 -p tcp -s 192.168.200.0/24 –dport 3306 -m state –state NEW,ESTABLISHED -j ACCEPT<br>iptables -A OUTPUT -o eth0 -p tcp –sport 3306 -m state –state ESTABLISHED -j ACCEPT</p>
<h1 id="允许-Sendmail-或-Postfix"><a href="#允许-Sendmail-或-Postfix" class="headerlink" title="允许 Sendmail 或 Postfix"></a>允许 Sendmail 或 Postfix</h1><p>iptables -A INPUT -i eth0 -p tcp –dport 25 -m state –state NEW,ESTABLISHED -j ACCEPT<br>iptables -A OUTPUT -o eth0 -p tcp –sport 25 -m state –state ESTABLISHED -j ACCEPT</p>
<h1 id="允许-IMAP-和-IMAPS"><a href="#允许-IMAP-和-IMAPS" class="headerlink" title="允许 IMAP 和 IMAPS"></a>允许 IMAP 和 IMAPS</h1><p>iptables -A INPUT -i eth0 -p tcp –dport 143 -m state –state NEW,ESTABLISHED -j ACCEPT<br>iptables -A OUTPUT -o eth0 -p tcp –sport 143 -m state –state ESTABLISHED -j ACCEPT<br>iptables -A INPUT -i eth0 -p tcp –dport 993 -m state –state NEW,ESTABLISHED -j ACCEPT<br>iptables -A OUTPUT -o eth0 -p tcp –sport 993 -m state –state ESTABLISHED -j ACCEPT</p>
<h1 id="允许-POP3-和-POP3S"><a href="#允许-POP3-和-POP3S" class="headerlink" title="允许 POP3 和 POP3S"></a>允许 POP3 和 POP3S</h1><p>iptables -A INPUT -i eth0 -p tcp –dport 110 -m state –state NEW,ESTABLISHED -j ACCEPT<br>iptables -A OUTPUT -o eth0 -p tcp –sport 110 -m state –state ESTABLISHED -j ACCEPT<br>iptables -A INPUT -i eth0 -p tcp –dport 995 -m state –state NEW,ESTABLISHED -j ACCEPT<br>iptables -A OUTPUT -o eth0 -p tcp –sport 995 -m state –state ESTABLISHED -j ACCEPT</p>
<h1 id="防止-DoS-攻击"><a href="#防止-DoS-攻击" class="headerlink" title="防止 DoS 攻击"></a>防止 DoS 攻击</h1><p>iptables -A INPUT -p tcp –dport 80 -m limit –limit 25/minute –limit-burst 100 -j ACCEPT</p>
<h1 id="设置-422-端口转发到-22-端口"><a href="#设置-422-端口转发到-22-端口" class="headerlink" title="设置 422 端口转发到 22 端口"></a>设置 422 端口转发到 22 端口</h1><p>iptables -t nat -A PREROUTING -p tcp -d 192.168.102.37 –dport 422 -j DNAT –to 192.168.102.37:22<br>iptables -A INPUT -i eth0 -p tcp –dport 422 -m state –state NEW,ESTABLISHED -j ACCEPT<br>iptables -A OUTPUT -o eth0 -p tcp –sport 422 -m state –state ESTABLISHED -j ACCEPT</p>
<h1 id="为丢弃的包做日志（Log）"><a href="#为丢弃的包做日志（Log）" class="headerlink" title="为丢弃的包做日志（Log）"></a>为丢弃的包做日志（Log）</h1><p>iptables -N LOGGING<br>iptables -A INPUT -j LOGGING<br>iptables -A LOGGING -m limit –limit 2/min -j LOG –log-prefix “IPTables Packet Dropped: “ –log-level 7<br>iptables -A LOGGING -j DROP</p>
<h1 id="屏蔽指定MAC地址"><a href="#屏蔽指定MAC地址" class="headerlink" title="屏蔽指定MAC地址"></a>屏蔽指定MAC地址</h1><p>使用如下规则可以屏蔽指定的 MAC 地址：<br>iptables -A INPUT -m mac –mac-source 00:00:00:00:00:00 -j DROP</p>
<h1 id="限制并发连接数"><a href="#限制并发连接数" class="headerlink" title="限制并发连接数"></a>限制并发连接数</h1><p>如果你不希望来自特定端口的过多并发连接，可以使用如下规则：<br>iptables -A INPUT -p tcp –syn –dport 22 -m connlimit –connlimit-above 3 -j REJECT<br>以上规则限制每客户端不超过 3 个连接。</p>
<h1 id="清空IPtables规则"><a href="#清空IPtables规则" class="headerlink" title="清空IPtables规则"></a>清空IPtables规则</h1><p>要清空 IPtables 链可以使用如下命令：<br>iptables -F<br>要清空特定的表可以使用 -t 参数进行指定，例如：<br>iptables -t nat –F</p>
<h1 id="保存IPtables规则"><a href="#保存IPtables规则" class="headerlink" title="保存IPtables规则"></a>保存IPtables规则</h1><p>默认情况下，管理员对 IPtables 规则的操作会立即生效。但由于规则都是保存在内存当中的，所以重启系统会造成配置丢失，要永久保存 IPtables 规则可以使用 iptables-save 命令：<br>iptables-save &gt; ~/iptables.rules<br>保存的名称大家可以自己改。</p>
<h1 id="还原IPtables规则"><a href="#还原IPtables规则" class="headerlink" title="还原IPtables规则"></a>还原IPtables规则</h1><p>有保存自然就对应有还原，大家可以使用 iptables-restore 命令还原已保存的规则：<br>iptables-restore &lt; ~/iptables.rules</p>
<h1 id="允许建立相关连接"><a href="#允许建立相关连接" class="headerlink" title="允许建立相关连接"></a>允许建立相关连接</h1><p>随着网络流量的进出分离，要允许建立传入相关连接，可以使用如下规则：<br>iptables -A INPUT -m conntrack –ctstate ESTABLISHED,RELATED -j ACCEPT<br>允许建立传出相关连接的规则：<br>iptables -A OUTPUT -m conntrack –ctstate ESTABLISHED -j ACCEPT</p>
<h1 id="丢弃无效数据包"><a href="#丢弃无效数据包" class="headerlink" title="丢弃无效数据包"></a>丢弃无效数据包</h1><p>很多网络×××都会尝试用×××自定义的非法数据包进行尝试，我们可以使用如下命令来丢弃无效数据包：<br>iptables -A INPUT -m conntrack –ctstate INVALID -j DROP</p>
<h1 id="IPtables屏蔽邮件发送规则"><a href="#IPtables屏蔽邮件发送规则" class="headerlink" title="IPtables屏蔽邮件发送规则"></a>IPtables屏蔽邮件发送规则</h1><p>如果你的系统不会用于邮件发送，我们可以在规则中屏蔽 SMTP 传出端口：<br>iptables -A OUTPUT -p tcp –dports 25,465,587 -j REJECT</p>
<h1 id="阻止连接到某块网卡"><a href="#阻止连接到某块网卡" class="headerlink" title="阻止连接到某块网卡"></a>阻止连接到某块网卡</h1><p>如果你的系统有多块网卡，我们可以限制 IP 范围访问某块网卡：<br>iptables -A INPUT -i eth0 -s xxx.xxx.xxx.xxx -j DROP<br>源地址可以是 IP 或 CIDR。</p>
<h1 id="只允许0、1网段访问ssh、VNC-zabbix-agent，允许访问-smtp-http-pop3-sunrpc-imap-ldap-lotusnote"><a href="#只允许0、1网段访问ssh、VNC-zabbix-agent，允许访问-smtp-http-pop3-sunrpc-imap-ldap-lotusnote" class="headerlink" title="只允许0、1网段访问ssh、VNC,zabbix agent，允许访问 smtp,http,pop3,sunrpc,imap,ldap,lotusnote"></a>只允许0、1网段访问ssh、VNC,zabbix agent，允许访问 smtp,http,pop3,sunrpc,imap,ldap,lotusnote</h1><p>iptables -A INPUT -i eth0 -p tcp -s 10.6.1.0/23 -m multiport –dports 22,5900,6000,10050 -m state –state NEW,ESTABLISHED -j ACCEPT<br>iptables -A INPUT -p tcp -m multiport –dports 25,80,110,111,143,389,1352 -m state –state NEW,ESTABLISHED -j ACCEPT<br>iptables -A OUTPUT -p tcp -m multiport –sports 22,25,80,110,111,143,389,1352,5900,6000,10050 -m state –state ESTABLISHED -j ACCEPT</p>
<h1 id="允许Ping"><a href="#允许Ping" class="headerlink" title="允许Ping"></a>允许Ping</h1><p>iptables -A INPUT -p icmp –icmp-type echo-request -j ACCEPT<br>iptables -A OUTPUT -p icmp –icmp-type echo-reply -j ACCEPT<br>iptables -A OUTPUT -p icmp –icmp-type echo-request -j ACCEPT<br>iptables -A INPUT -p icmp –icmp-type echo-reply -j ACCEPT</p>
<h1 id="设置默认的-chain-策略"><a href="#设置默认的-chain-策略" class="headerlink" title="设置默认的 chain 策略"></a>设置默认的 chain 策略</h1><p>iptables -P INPUT DROP<br>iptables -P FORWARD DROP<br>iptables -P OUTPUT DROP</p>
<h1 id="保存"><a href="#保存" class="headerlink" title="保存"></a>保存</h1><p>service iptables save</p>
<h1 id="查看规则"><a href="#查看规则" class="headerlink" title="查看规则"></a>查看规则</h1><p>iptables -L</p>
<ul>
<li>你可以使用如下命令来查看 IPtables 防火墙策略：<br>iptables -L -n -v</li>
<li>以上命令是查看默认的 FILTER 表，如果你只希望查看特定的表，可以在 -t 参数后跟上要单独查看的表名。例如只查看 NAT 表中的规则，可以使用如下命令：<br>iptables -t nat -L -v –n</li>
</ul>
</section>
    <!-- Tags START -->
    
    <!-- Tags END -->
    <!-- NAV START -->
    
  <div class="nav-container">
    <!-- reverse left and right to put prev and next in a more logic postition -->
    
      <a class="nav-left" href="/blog/2018/09/03/Linux-Iptables-导入导出/">
        <span class="nav-arrow">← </span>
        
          Linux-Iptables-导入导出
        
      </a>
    
    
      <a class="nav-right" href="/blog/2018/09/03/Linux-配置使用密钥登录/">
        
          Linux-配置使用密钥登录
        
        <span class="nav-arrow"> →</span>
      </a>
    
  </div>

    <!-- NAV END -->
    
      <!-- No Comment -->
    
  </article>
  <!-- Article END -->
  <!-- Catalog START -->
  
    <aside class="catalog-container">
  <div class="toc-main">
    <strong class="toc-title">Catalog</strong>
    
      <ol class="toc-nav"><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#启动、停止和重启iptables"><span class="toc-nav-text">启动、停止和重启iptables</span></a><ol class="toc-nav-child"><li class="toc-nav-item toc-nav-level-2"><a class="toc-nav-link" href="#基于SystemD的系统"><span class="toc-nav-text">基于SystemD的系统</span></a></li><li class="toc-nav-item toc-nav-level-2"><a class="toc-nav-link" href="#基于SysVinit的系统"><span class="toc-nav-text">基于SysVinit的系统</span></a></li></ol></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#屏蔽某个IP地址"><span class="toc-nav-text">屏蔽某个IP地址</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#阻止某个特定的-IP-地址"><span class="toc-nav-text">阻止某个特定的 IP 地址</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#解封某个IP地址"><span class="toc-nav-text">解封某个IP地址</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#使用IPtables关闭特定端口"><span class="toc-nav-text">使用IPtables关闭特定端口</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#允许全部入站的（incoming）SSH"><span class="toc-nav-text">允许全部入站的（incoming）SSH</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#只允许某个特定网络进来的-SSH"><span class="toc-nav-text">只允许某个特定网络进来的 SSH</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#允许入站的（incoming）HTTP"><span class="toc-nav-text">允许入站的（incoming）HTTP</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#多端口（允许进来的-SSH、HTTP-和-HTTPS）"><span class="toc-nav-text">多端口（允许进来的 SSH、HTTP 和 HTTPS）</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#允许出站的（outgoing）SSH"><span class="toc-nav-text">允许出站的（outgoing）SSH</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#允许出站的（outgoing）SSH，但仅访问某个特定的网络"><span class="toc-nav-text">允许出站的（outgoing）SSH，但仅访问某个特定的网络</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#允许出站的（outgoing）-HTTPS"><span class="toc-nav-text">允许出站的（outgoing） HTTPS</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#对进来的-HTTPS-流量做负载均衡"><span class="toc-nav-text">对进来的 HTTPS 流量做负载均衡</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#从内部向外部-Ping"><span class="toc-nav-text">从内部向外部 Ping</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#从外部向内部-Ping"><span class="toc-nav-text">从外部向内部 Ping</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#使用Multiport控制多端口"><span class="toc-nav-text">使用Multiport控制多端口</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#在规则中使用-IP-地址范围"><span class="toc-nav-text">在规则中使用 IP 地址范围</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#配置端口转发"><span class="toc-nav-text">配置端口转发</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#禁止PING"><span class="toc-nav-text">禁止PING</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#允许访问回环网卡"><span class="toc-nav-text">允许访问回环网卡</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#允许-packets-从内网访问外网"><span class="toc-nav-text">允许 packets 从内网访问外网</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#允许外出的-DNS"><span class="toc-nav-text">允许外出的 DNS</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#允许-NIS-连接"><span class="toc-nav-text">允许 NIS 连接</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#允许某个特定网络-rsync-进入本机"><span class="toc-nav-text">允许某个特定网络 rsync 进入本机</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#仅允许来自某个特定网络的-MySQL-的链接"><span class="toc-nav-text">仅允许来自某个特定网络的 MySQL 的链接</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#允许-Sendmail-或-Postfix"><span class="toc-nav-text">允许 Sendmail 或 Postfix</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#允许-IMAP-和-IMAPS"><span class="toc-nav-text">允许 IMAP 和 IMAPS</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#允许-POP3-和-POP3S"><span class="toc-nav-text">允许 POP3 和 POP3S</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#防止-DoS-攻击"><span class="toc-nav-text">防止 DoS 攻击</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#设置-422-端口转发到-22-端口"><span class="toc-nav-text">设置 422 端口转发到 22 端口</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#为丢弃的包做日志（Log）"><span class="toc-nav-text">为丢弃的包做日志（Log）</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#屏蔽指定MAC地址"><span class="toc-nav-text">屏蔽指定MAC地址</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#限制并发连接数"><span class="toc-nav-text">限制并发连接数</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#清空IPtables规则"><span class="toc-nav-text">清空IPtables规则</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#保存IPtables规则"><span class="toc-nav-text">保存IPtables规则</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#还原IPtables规则"><span class="toc-nav-text">还原IPtables规则</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#允许建立相关连接"><span class="toc-nav-text">允许建立相关连接</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#丢弃无效数据包"><span class="toc-nav-text">丢弃无效数据包</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#IPtables屏蔽邮件发送规则"><span class="toc-nav-text">IPtables屏蔽邮件发送规则</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#阻止连接到某块网卡"><span class="toc-nav-text">阻止连接到某块网卡</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#只允许0、1网段访问ssh、VNC-zabbix-agent，允许访问-smtp-http-pop3-sunrpc-imap-ldap-lotusnote"><span class="toc-nav-text">只允许0、1网段访问ssh、VNC,zabbix agent，允许访问 smtp,http,pop3,sunrpc,imap,ldap,lotusnote</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#允许Ping"><span class="toc-nav-text">允许Ping</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#设置默认的-chain-策略"><span class="toc-nav-text">设置默认的 chain 策略</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#保存"><span class="toc-nav-text">保存</span></a></li><li class="toc-nav-item toc-nav-level-1"><a class="toc-nav-link" href="#查看规则"><span class="toc-nav-text">查看规则</span></a></li></ol>
    
  </div>
</aside>
  
  <!-- Catalog END -->
</main>

<script>
  (function () {
    var url = 'git@gitee.com:sanyuanempire/blog.git/2018/09/03/Linux-Iptables-常用规则/';
    var banner = ''
    if (banner !== '' && banner !== 'undefined' && banner !== 'null') {
      $('#article-banner').css({
        'background-image': 'url(' + banner + ')'
      })
    } else {
      $('#article-banner').geopattern(url)
    }
    $('.header').removeClass('fixed-header')

     // error image
    $(".markdown-content img").on('error', function() {
      $(this).attr('src', 'http://file.muyutech.com/error-img.png')
      $(this).css({
        'cursor': 'default'
      })
    })

    // zoom image
    $(".markdown-content img").on('click', function() {
      var src = $(this).attr('src')
      if (src !== 'http://file.muyutech.com/error-img.png') {
        var imageW = $(this).width()
        var imageH = $(this).height()
        
        var zoom = ($(window).width() * 0.95 / imageW).toFixed(2)
        zoom = zoom < 1 ? 1 : zoom
        zoom = zoom > 2 ? 2 : zoom
        var transY = (($(window).height() - imageH) / 2).toFixed(2)

        $('body').append('<div class="image-view-wrap"><div class="image-view-inner"><img src="'+ src +'" /></div></div>')
        $('.image-view-wrap').addClass('wrap-active')
        $('.image-view-wrap img').css({
          'width': `${imageW}`,
          'transform': `translate3d(0, ${transY}px, 0) scale3d(${zoom}, ${zoom}, 1)`
        })
        $('html').css('overflow', 'hidden')

        $('.image-view-wrap').on('click', function() {
          $(this).remove()
          $('html').attr('style', '')
        })
      }
    })

    // qrcode
    var qr = new QRious({
      element: document.getElementById('share-qrcode'),
      value: document.location.href
    });

    // gitment
    var gitmentConfig = "";
    if (gitmentConfig !== 'undefined') {
      var gitment = new Gitment({
        id: "Linux-Iptables-常用规则",
        owner: "",
        repo: "",
        oauth: {
          client_id: "",
          client_secret: ""
        },
        theme: {
          render(state, instance) {
            const container = document.createElement('div')
            container.lang = "en-US"
            container.className = 'gitment-container gitment-root-container'
            container.appendChild(instance.renderHeader(state, instance))
            container.appendChild(instance.renderEditor(state, instance))
            container.appendChild(instance.renderComments(state, instance))
            container.appendChild(instance.renderFooter(state, instance))
            return container;
          }
        }
      })
      gitment.render(document.getElementById('comments'))
    }
  })();
</script>

<script>
  var disqus_shortname = '';
  
  var disqus_url = 'git@gitee.com:sanyuanempire/blog.git/2018/09/03/Linux-Iptables-常用规则/';
  
  (function(){
    var dsq = document.createElement('script');
    dsq.type = 'text/javascript';
    dsq.async = true;
    dsq.src = '//go.disqus.com/embed.js';
    (document.getElementsByTagName('head')[0] || document.getElementsByTagName('body')[0]).appendChild(dsq);
  })();
</script>

    <div class="scroll-top">
  <span class="arrow-icon"></span>
</div>
    <footer class="app-footer">
  <p class="copyright">
    &copy; 2018 | Proudly powered by <a href="https://sanyuanempire.gitee.io/blog" target="_blank">JinYan</a>
    <br>
    Theme by <a href="https://sanyuanempire.gitee.io/blog">JinYan</a>
  </p>
</footer>

<script>
  function async(u, c) {
    var d = document, t = 'script',
      o = d.createElement(t),
      s = d.getElementsByTagName(t)[0];
    o.src = u;
    if (c) { o.addEventListener('load', function (e) { c(null, e); }, false); }
    s.parentNode.insertBefore(o, s);
  }
</script>
<script>
  async("//cdn.bootcss.com/fastclick/1.0.6/fastclick.min.js", function(){
    FastClick.attach(document.body);
  })
</script>

<script>
  var hasLine = 'true';
  async("//cdn.bootcss.com/highlight.js/9.12.0/highlight.min.js", function(){
    $('figure pre').each(function(i, block) {
      var figure = $(this).parents('figure');
      if (hasLine === 'false') {
        figure.find('.gutter').hide();
      }
      var lang = figure.attr('class').split(' ')[1] || 'code';
      var codeHtml = $(this).html();
      var codeTag = document.createElement('code');
      codeTag.className = lang;
      codeTag.innerHTML = codeHtml;
      $(this).attr('class', '').empty().html(codeTag);
      figure.attr('data-lang', lang.toUpperCase());
      hljs.highlightBlock(block);
    });
  })
</script>
<!-- Baidu Tongji -->

<script src="/blog/js/script.js"></script>

  </body>
</html>